From 8f71257d6246d234d21fae66933d944ceee41794 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Tue, 25 Aug 2026 19:37:57 +0200 Subject: [PATCH 1/3] Use new release workflow of cap-java/.github and update shas --- .github/workflows/issue.yml | 2 +- .github/workflows/main.yml | 2 +- .github/workflows/pipeline.yml | 4 +- .github/workflows/pr.yml | 2 +- .github/workflows/prevent-issue-labeling.yml | 2 +- .github/workflows/release.yml | 124 +------------------ .github/workflows/stale.yml | 2 +- 7 files changed, 13 insertions(+), 125 deletions(-) diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml index 20b554cbd..28afbec0e 100644 --- a/.github/workflows/issue.yml +++ b/.github/workflows/issue.yml @@ -9,4 +9,4 @@ on: jobs: label-issue: - uses: cap-java/.github/.github/workflows/issue.yml@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/.github/workflows/issue.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 09eb9fafb..4508bbb37 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With Black Duck - uses: cap-java/.github/actions/scan-with-blackduck@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/actions/scan-with-blackduck@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index 565ae5a73..c79031ac8 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -116,7 +116,7 @@ jobs: auth-method: basic - name: SonarQube Scan - uses: cap-java/.github/actions/scan-with-sonar@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/actions/scan-with-sonar@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main with: java-version: 21 maven-version: ${{ env.MAVEN_VERSION }} @@ -145,7 +145,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: CodeQL Analysis - uses: cap-java/.github/actions/scan-with-codeql@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/actions/scan-with-codeql@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main with: java-version: 21 maven-version: ${{ env.MAVEN_VERSION }} diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 7770f2956..e5ba73acb 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Scan With Black Duck - uses: cap-java/.github/actions/scan-with-blackduck@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/actions/scan-with-blackduck@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} diff --git a/.github/workflows/prevent-issue-labeling.yml b/.github/workflows/prevent-issue-labeling.yml index 460d018d7..8cdaac921 100644 --- a/.github/workflows/prevent-issue-labeling.yml +++ b/.github/workflows/prevent-issue-labeling.yml @@ -8,4 +8,4 @@ on: jobs: prevent-issue-labeling: - uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fbe97a27d..485ae987e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,125 +1,13 @@ name: Deploy to Maven Central -env: - JAVA_VERSION: '21' - MAVEN_VERSION: '3.9.16' - on: release: types: [ "released" ] jobs: - requires-approval: - runs-on: ubuntu-latest - name: "Waiting for release approval" - environment: release-approval - permissions: - contents: read - steps: - - name: Approval Step - run: echo "Release has been approved!" - - verify-version: - needs: requires-approval - name: Verify Version Matches Tag - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - with: - ref: ${{ github.event.release.tag_name }} - - - name: Set up Java - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 - with: - java-version: ${{ env.JAVA_VERSION }} - distribution: sapmachine - cache: maven - - - name: Set up Maven - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ env.MAVEN_VERSION }} - - - name: Verify pom.xml revision matches release tag - run: | - TAG="${{ github.event.release.tag_name }}" - REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout) - echo "Tag: $TAG" - echo "Revision: $REVISION" - if [ "$TAG" != "$REVISION" ]; then - echo "::error::Release tag '$TAG' does not match pom.xml '$REVISION'. Open a 'Prep release' PR to bump the version before tagging." - exit 1 - fi - shell: bash - - blackduck: - needs: verify-version - name: Blackduck Scan - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - with: - ref: ${{ github.event.release.tag_name }} - - - name: Scan With Black Duck - uses: cap-java/.github/actions/scan-with-blackduck@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main - with: - blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} - github_token: ${{ secrets.GITHUB_TOKEN }} - maven-version: ${{ env.MAVEN_VERSION }} - project-name: com.sap.cds.feature.attachments - included-modules: cds-feature-attachments,cds-feature-attachments-oss,cds-feature-attachments-fs - version: ${{ github.event.release.tag_name }} - - build: - name: Build - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: verify-version - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - with: - ref: ${{ github.event.release.tag_name }} - - - name: Build - uses: cap-java/.github/actions/build@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main - with: - java-version: ${{ env.JAVA_VERSION }} - maven-version: ${{ env.MAVEN_VERSION }} - - deploy: - name: Deploy to Maven Central - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: [blackduck, build] - environment: release - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - with: - ref: ${{ github.event.release.tag_name }} - - - name: Deploy - uses: cap-java/.github/actions/deploy-release@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main - with: - user: ${{ secrets.CENTRAL_REPOSITORY_USER }} - password: ${{ secrets.CENTRAL_REPOSITORY_PASS }} - gpg-pub-key: ${{ secrets.PGP_PUBKEY_ID }} - gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }} - gpg-passphrase: ${{ secrets.PGP_PASSPHRASE }} - revision: ${{ github.event.release.tag_name }} - java-version: ${{ env.JAVA_VERSION }} - maven-version: ${{ env.MAVEN_VERSION }} + release: + uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 + with: + blackduck-project-name: com.sap.cds.feature.attachments + blackduck-included-modules: cds-feature-attachments,cds-feature-attachments-oss,cds-feature-attachments-fs + secrets: inherit diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 9c60d62a2..02c2a887c 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -8,4 +8,4 @@ on: jobs: stale: - uses: cap-java/.github/.github/workflows/stale.yml@5fc795c5049bb4d49e957346df2e5d6d7c0c23b9 #main + uses: cap-java/.github/.github/workflows/stale.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main From ad6c67d9d30ed316e4dd0e03ef1d6e5771f73f11 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Wed, 26 Aug 2026 12:18:45 +0200 Subject: [PATCH 2/3] Update .github/workflows/release.yml Co-authored-by: hyperspace-pr-bot[bot] <209611008+hyperspace-pr-bot[bot]@users.noreply.github.com> Signed-off-by: Lisa Julia Nebel --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 485ae987e..bd2a66768 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ on: jobs: release: - uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 + uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main with: blackduck-project-name: com.sap.cds.feature.attachments blackduck-included-modules: cds-feature-attachments,cds-feature-attachments-oss,cds-feature-attachments-fs From ac3990eb8fc6967302932c9b302e36e33bc3a602 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Wed, 26 Aug 2026 12:19:12 +0200 Subject: [PATCH 3/3] Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Lisa Julia Nebel --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bd2a66768..11ea86d36 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,9 @@ on: release: types: [ "released" ] +permissions: + contents: read + jobs: release: uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main